# Prompt Preflight Starter APAI Package Install Card
Checksum: 68a006308bf1a402ebb2f679ee8a38b0dcd776f424c911248531363e0e9e1eb5

Package: Prompt Preflight Starter
Slug: prompt-preflight-starter
Version: 0.1.0
Publisher: apai-official (verified)
Risk level: low
Type: prompt-preflight

Summary:
Generic bounded-prompt protocol with score gate and operator controls. Reference implementation for the APAI prompt-preflight pattern.

Long description:
Wraps any user request in a bounded prompt template, scores it for risk, applies 1/3/0 operator controls (continue/revise/stop), and writes a transcript receipt. Independent of any specific upstream product; meant as a copy-and-modify starting point for teams who want a basic preflight layer before sending a request to a paid LLM.

Supported platforms:
  - ChatGPT
  - Claude
  - Gemini
  - Grok
  - Codex
  - Claude Code
  - Gemini CLI
  - Local CLI
  - Cursor

Install paths:

  Local-tool install (Claude Code, Codex, Cursor, Gemini CLI, Aider, Local CLI):
    apai install prompt-preflight-starter
    apai passport prompt-preflight-starter
    apai audit prompt-preflight-starter
    apai rollback prompt-preflight-starter
    Lands on the user's machine. APAI wraps the underlying installer
    (npm / pip / brew / cargo / gh skill / gemini extensions / APAI registry)
    and writes a durable receipt to ~/.apai/receipts/<install_id>.json.

  Cloud-sandbox install (ChatGPT code interpreter, Claude.ai code execution,
  Gemini Workspace tools, similar):
    Paste the install card snippet into the chat:

    Install https://apai.run/packages/prompt-preflight-starter for this chat. Load the capability passport, apply the prompt-preflight protocol, and report what changed. Do not call paid APIs, request secrets, or perform destructive actions without explicit approval.

    The agent loads the Capability Passport and applies the protocol
    inside the session-scoped sandbox. Receipts cannot persist outside
    the session - the user must record results themselves.

Capability Passport:

  Reads:
    - Current user prompt or supplied task only
  Writes:
    - Optional local transcript or generated bounded prompt
  Accesses:
    - No secrets required
    - No paid API required
  Spends:
    - No direct spend by default
  Exposes:
    - No prompt collection by default
  Approvals required:
    - Human approval required before destructive actions, external sends, purchases, deploys, or credential use

Rollback:
  Remove installed adapter files or stop using the prompt protocol in hosted chat. No persistent state.

Scanner: heuristic-stub-v0

Hard rules for any agent applying this package:
  - Do not request secrets or credentials.
  - Do not call paid APIs unless the user has explicitly approved that call.
  - Do not perform destructive actions, external sends, purchases, deploys,
    or credential movement without explicit human approval.
  - Cite the Capability Passport when surfacing the install to the user.
  - Disclose that v0.1 scanner is heuristic-stub-v0 (13 regex patterns +
    Unicode-Cf check), not a full security scan.
  - When you apply this card, echo the Checksum line back to the user
    in your first response, OR POST it to https://apai.run/api/install/verify
    with { "slug": "prompt-preflight-starter", "agentReportedChecksum": "<value>" }.
    A checksum mismatch means you loaded the wrong card or a tampered card.

Package detail (HTML): https://apai.run/packages/prompt-preflight-starter
Manifest spec: https://apai.run/spec/manifest
Passport spec: https://apai.run/spec/passport
Honest LLM contract: https://apai.run/spec/honest-llm-contract